Health Insurance Portability & Accountability Act (HIPAA)

Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal law enacted in 1996. Its fundamental purpose is to protect the privacy and security of individually identifiable health information. HIPAA sets national standards for the handling and safeguarding Protected Health Information (PHI), which includes any health-related data that can be linked to an individual. 

The main rules of HIPAA are:

• The Privacy Rule: This rule establishes standards for protecting personal health information and an individual’s medical records. It gives patients the right to access their health information and limits the disclosure of PHI without the patient’s authorization.
• The Security Rule: The HIPAA Security Rule lays out requirements for securing electronic PHI (ePHI). It outlines administrative, technical, and physical safeguards that covered entities must implement to protect ePHI from unauthorized access, use, and disclosure.
• The Breach Notification Rule: This rule mandates covered entities and their business associates to notify the Department of Health and Human Services (HHS) and affected individuals in the event of a breach of unsecured PHI.
• The Enforcement Rule: The Enforcement Rule outlines the procedures for investigations and penalties related to HIPAA violations.

HIPAA applies to covered entities and their business associates. Covered entities are organizations that must comply with the HIPAA regulations and include:

• Healthcare Providers: Hospitals, clinics, doctors, dentists, psychologists, and other healthcare practitioners.
• Health Plans: Health Maintenance Organizations (HMOs), Health Insurance Companies, and government programs like Medicaid and Medicare.
• Healthcare Clearinghouses: These include organizations that process non-standard health information into a standard format (e.g., converting paper claims to electronic).
• Business Associates: Business Associates are individuals or organizations that perform certain functions or activities on behalf of covered entities. They are included under HIPAA since their work involves the use or disclosure of PHI. Examples of business associates include IT support services, billing companies, and third-party administrators.

The Office for Civil Rights (OCR), which operates under the U.S. Department of Health and Human Services (HHS), is responsible for monitoring and enforcing compliance with HIPAA. OCR investigates complaints of HIPAA violations and can impose civil and criminal penalties for non-compliance.

While HIPAA covers a wide variety of security practices, healthcare providers and business associates need to be cognizant of the threat of cyber attacks and ransomware even if they are HIPAA-compliant. Connect with our HIPAA Experts to assess your controls and prove your compliance with HIPAA by sharing your assessment profile. Our engagement options are ideal for organizations of all sizes with and without an experienced in-house IT team. Connect with an expert or schedule a consultation to explore the option that is best for your organization.